From 4a0f89766df0ec6224c43ed34d7362d10f07931d Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 1 Nov 2026 20:26:50 +0000 Subject: [PATCH] Skip the DCO check on release PRs into main Release PRs carry the whole history, including commits from before sign-off was required, so the check always failed there. Their commits were already checked on their way into development. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01D8A4w121dBr3nYoutNLaV7 Signed-off-by: Claude --- .github/workflows/ci.yml | 4 +++- CHANGELOG.md | 1 + CONTRIBUTING.md | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 68d5a5f..cb83094 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -197,7 +197,9 @@ jobs: dco: name: DCO sign-off - if: ${{ github.event_name == 'pull_request' }} + # Release PRs (development into main) carry the whole history, including commits from before + # sign-off was required. Their commits were already checked on their way into development. + if: ${{ github.event_name == 'pull_request' && github.base_ref != 'main' }} runs-on: ubuntu-latest timeout-minutes: 5 steps: diff --git a/CHANGELOG.md b/CHANGELOG.md index 8428d13..0c131a9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed - The metrics API builds with Go 1.27 (`go.mod` and the Docker builder image `golang:1.27-alpine`). Replaces Dependabot PR #5, which bumped only the Dockerfile. +- The DCO sign-off CI job skips release pull requests into `main`. Their commits were already checked on their way into `development`, and the history includes commits from before sign-off was required. ## [1.0.0] - 2026-11-01 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c4cd3bf..0f79845 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -111,7 +111,7 @@ git rebase --signoff development git push --force-with-lease ``` -The **DCO sign-off** CI job checks every commit in a pull request (merge commits aside) for a `Signed-off-by` line with the commit author's email. Dependabot's commits and commits written by the maintainers' AI coding assistant are exempt; a maintainer reviews and merges those. +The **DCO sign-off** CI job checks every commit in a pull request (merge commits aside) for a `Signed-off-by` line with the commit author's email. Dependabot's commits and commits written by the maintainers' AI coding assistant are exempt; a maintainer reviews and merges those. The job does not run on release pull requests into `main`, because their commits were already checked on their way into `development`. If your employer has rights to code you write, make sure you are allowed to contribute before you sign off.